chore(security): make rsa key pair only use once for sql login

pingcap · Sep 8, 2023 · c0916bd · c0916bd
1 parent ded9a32
commit c0916bd
Show file tree

Hide file tree

Showing 2 changed files with 13 additions and 6 deletions.
diff --git a/pkg/apiserver/user/auth.go b/pkg/apiserver/user/auth.go
@@ -122,6 +122,15 @@ func NewAuthService(featureFlags *featureflag.Registry) *AuthService {
 			if err != nil {
 				return nil, errorx.Decorate(err, "authenticate failed")
 			}
+			if form.Type == 0 {
+				// generate new rsa key pair for each sql auth login
+				privateKey, publicKey, err := GenerateKey()
+				// if generate successfully, replace the old key pair
+				if err == nil {
+					service.RsaPrivateKey = privateKey
+					service.rsaPublicKey = publicKey
+				}
+			}
 			return u, nil
 		},
 		PayloadFunc: func(data interface{}) jwt.MapClaims {

diff --git a/pkg/apiserver/user/sqlauth/sqlauth.go b/pkg/apiserver/user/sqlauth/sqlauth.go
@@ -3,8 +3,6 @@
 package sqlauth
 
 import (
-	"crypto/rsa"
-
 	"github.com/joomcode/errorx"
 	"go.uber.org/fx"
 
@@ -17,8 +15,8 @@ const typeID utils.AuthType = 0
 
 type Authenticator struct {
 	user.BaseAuthenticator
-	tidbClient    *tidb.Client
-	rsaPrivateKey *rsa.PrivateKey
+	tidbClient  *tidb.Client
+	authService *user.AuthService
 }
 
 func NewAuthenticator(tidbClient *tidb.Client) *Authenticator {
@@ -29,7 +27,7 @@ func NewAuthenticator(tidbClient *tidb.Client) *Authenticator {
 
 func registerAuthenticator(a *Authenticator, authService *user.AuthService) {
 	authService.RegisterAuthenticator(typeID, a)
-	a.rsaPrivateKey = authService.RsaPrivateKey
+	a.authService = authService
 }
 
 var Module = fx.Options(
@@ -38,7 +36,7 @@ var Module = fx.Options(
 )
 
 func (a *Authenticator) Authenticate(f user.AuthenticateForm) (*utils.SessionUser, error) {
-	plainPwd, err := user.Decrypt(f.Password, a.rsaPrivateKey)
+	plainPwd, err := user.Decrypt(f.Password, a.authService.RsaPrivateKey)
 	if err != nil {
 		return nil, user.ErrSignInOther.WrapWithNoMessage(err)
 	}